Is it possible to use the same subsearch twice in a search?

[pduflot]

Hello,

Is it possible to use the same subsearch twice in a search? Of course without having Splunk to execute the search twice, but having it caching the results.

[inventsekar · Accepted solution]

i think, its possible to use the same subsearch twice in a query.
also, the limits.conf has a parameter "ttl" - Time to cache a given subsearch's results, in seconds, default value 300 seconds.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Aboutsubsearches
on Splunk Enterprise, limits.conf
[subsearch]
maxout =

Maximum number of results to return from a subsearch.
This value cannot be greater than or equal to 10500.
Defaults to 10000.
maxtime =

Maximum number of seconds to run a subsearch before finalizing
Defaults to 60.
ttl =

Time to cache a given subsearch's results, in seconds.
Do not set this below 120 seconds.
Defaults to 300.